Intranet access method, device, equipment and computer-readable storage medium

Abstract

The present application provides an intranet access method, device, equipment and computer-readable storage medium, which relates to the field of cloud technology; the method includes: receiving an encapsulated data packet sent by a terminal through a virtual traffic proxy device; the encapsulated data packet is obtained by encapsulating an application data packet intercepted by the terminal through a virtual network card device; based on the protocol type corresponding to the encapsulated data packet, the encapsulated data packet is transmitted to the intranet service device in a channel; the encapsulated data packet is decapsulated by the intranet service device to obtain an application data packet, and identity information is extracted from the application data packet; when the identity information authentication is passed, the intranet service device responds to the intranet access request in the application data packet to establish an intranet access connection with the terminal. Through this application, the convenience of intranet access in cloud technology can be improved.

Description

Technical Field

[0001] The present application relates to cloud technology, and more particularly to an intranet access method, apparatus, device and computer-readable storage medium. Background Art

[0002] Full-scale office means that you can work at your workplace or at a non-workplace, for example, you can work through the Internet at your residence, outdoors, etc. The premise of full-scale office is that users can smoothly access the intranet through the external network to interact with the resources of the intranet. In related technologies, when users access the intranet through a mobile terminal, they need to configure a VPN agent when they access it for the first time. The configuration process of the VPN agent is quite complicated and cumbersome, which makes the convenience of intranet access low. Summary of the invention

[0003] The embodiments of the present application provide an intranet access method, apparatus, device and computer-readable storage medium, which can improve the convenience of intranet access and expand the range of data packet types for intranet access.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present application provides an intranet access method, including:

[0006] Receiving an encapsulated data packet sent by a terminal through a virtual traffic proxy device; the encapsulated data packet is obtained by encapsulating an application data packet intercepted by the terminal through a virtual network card device;

[0007] Based on the protocol type corresponding to the encapsulated data packet, transmitting the encapsulated data packet to the intranet service device in a channel;

[0008] Decapsulating the encapsulated data packet through the intranet service device to obtain an application data packet, and extracting identity information from the application data packet;

[0009] When the identity information authentication is passed, the intranet service device responds to the intranet access request in the application data packet to establish an intranet access connection with the terminal.

[0010] In some embodiments of the present application, decapsulating the encapsulated data packet by the intranet service device to obtain the application data packet includes:

[0011] Removing each protocol header in the encapsulated data packet layer by layer through the intranet service device until a data body without a protocol header is obtained; each protocol header represents additional information during transmission;

[0012] The data body not including the protocol header is used as the application data packet.

[0013] The present application provides an intranet access method, including:

[0014] When an application data packet containing an intranet access request and identity information of an application is detected, the application data packet is intercepted by a virtual network card device;

[0015] Encapsulating the application data packet through the virtual network card device to obtain an encapsulated data packet;

[0016] The encapsulated data packet is sent to the server through the communication interface plug-in, so that the server determines the transmission mode of the encapsulated data packet according to the protocol type corresponding to the encapsulated data packet, and transmits the encapsulated data packet to the intranet service device according to the transmission mode. The encapsulated data packet is decapsulated by the intranet service device to obtain an application data packet, and identity information is extracted from the application data packet. When the identity information is authenticated, the server responds to the intranet access request in the application data packet and establishes an intranet access connection.

[0017] In some embodiments of the present application, the at least one interface plug-in includes: a network communication interface plug-in and a virtual private network proxy service plug-in.

[0018] The present application embodiment provides an intranet access device, including:

[0019] A data receiving module, used for receiving an encapsulated data packet sent by a terminal through a virtual traffic proxy device; the encapsulated data packet is obtained by encapsulating an application data packet intercepted by the terminal through a virtual network card device;

[0020] A data transmission module, used for transmitting the encapsulated data packet to the intranet service device in different channels based on the protocol type corresponding to the encapsulated data packet;

[0021] A data decapsulation module, used to decapsulate the encapsulated data packet through the intranet service device to obtain an application data packet, and extract identity information from the application data packet;

[0022] The connection establishment module is used to establish an intranet access connection with the terminal by responding to the intranet access request in the application data packet through the intranet service device when the identity information authentication is passed.

[0023] In some embodiments of the present application, the data transmission module is also used to send the encapsulated data packet directly to the intranet service device when the protocol type corresponding to the encapsulated data packet is a connectionless protocol, so as to transmit the encapsulated data packet to the intranet service device in a channel; when the protocol type corresponding to the encapsulated data packet is a connection-oriented protocol, forward the encapsulated data packet to the intranet service device through a gateway, so as to transmit the encapsulated data packet to the intranet service device in a channel.

[0024] In some embodiments of the present application, the data transmission module is also used to perform protocol conversion on the encapsulated data packet to obtain a converted data packet when the protocol type corresponding to the encapsulated data packet belongs to other protocol types except the connectionless protocol and the connection-oriented protocol; wherein the protocol type corresponding to the converted data packet is any one of the connectionless protocol and the connection-oriented protocol, the connectionless protocol includes the User Datagram Protocol, the connection-oriented protocol includes the Transmission Control Protocol, and the other protocol types include the Internet Protocol; based on the protocol type corresponding to the converted data packet, determine the matching transmission mode corresponding to the converted data packet, and send the converted data packet to the intranet service device based on the matching transmission mode, so as to transmit the encapsulated data packet to the intranet service device in a channel.

[0025] In some embodiments of the present application, the data transmission module is further used to perform a three-way handshake between the virtual traffic proxy device and the gateway, and establish a local connection between the virtual traffic proxy device and the gateway when the handshake is successful;

[0026] The data transmission module is further used to transmit the encapsulated data packet to the gateway via the local connection; and forward the encapsulated data packet to the intranet service device via the gateway.

[0027] In some embodiments of the present application, the data decapsulation module is also used to remove each protocol header in the encapsulated data packet layer by layer through the intranet service device until a data body that does not contain a protocol header is obtained; each protocol header represents additional information during transmission; and the data body that does not contain a protocol header is used as the application data packet.

[0028] The present application embodiment provides an intranet access device, including:

[0029] A data interception module, for intercepting an application data packet containing an intranet access request and identity information of an application program through a virtual network card device when an application data packet is detected;

[0030] A data encapsulation module, used to encapsulate the application data packet through the virtual network card device to obtain an encapsulated data packet;

[0031] A data sending module is used to send the encapsulated data packet to the server through a communication interface plug-in, so that the server determines the transmission mode of the encapsulated data packet according to the protocol type corresponding to the encapsulated data packet, and transmits the encapsulated data packet to the intranet service device according to the transmission mode, decapsulates the encapsulated data packet through the intranet service device to obtain an application data packet, extracts identity information from the application data packet, and establishes an intranet access connection in response to the intranet access request in the application data packet when the identity information is authenticated.

[0032] In some embodiments of the present application, the communication interface plug-in includes: at least one interface plug-in corresponding to at least one operating system;

[0033] The data sending module is also used to select a target interface plug-in corresponding to the encapsulated data packet from the at least one interface plug-in corresponding to the at least one operating system according to the operating system; and send the encapsulated data packet to the server using the target interface plug-in corresponding to the encapsulated data packet.

[0034] An embodiment of the present application provides a server, including:

[0035] A first memory, used to store executable intranet access instructions;

[0036] The first processor is used to implement the intranet access method provided by the server side of the embodiment of the present application when executing the executable intranet access instruction stored in the first memory.

[0037] An embodiment of the present application provides a terminal, including:

[0038] A second memory, used for storing executable intranet access instructions;

[0039] The second processor is used to implement the intranet access method provided by the terminal side of the embodiment of the present application when executing the executable intranet access instruction stored in the second memory.

[0040] An embodiment of the present application provides a computer-readable storage medium storing executable intranet access instructions, which are used to cause a first processor to execute and implement an intranet access method provided by a server side of an embodiment of the present application; or to cause a second processor to execute and implement an intranet service method provided by a terminal side of an embodiment of the present application.

[0041] The embodiments of the present application have the following beneficial effects: the server receives the encapsulated data packets sent by the terminal through the virtual traffic proxy device, and since the encapsulated data packets are obtained by encapsulating the application data packets intercepted by the terminal through the virtual network card device, full traffic proxy for the application data packets is implemented, so that users can access the intranet without any configuration, reducing the configuration preparation during intranet access and greatly improving the convenience of intranet access; and determining the corresponding transmission mode according to the protocol type of the encapsulated data packet, thereby implementing channel processing for encapsulated data packets of different protocol types, so that different types of traffic can successfully access the intranet, expanding the range of data packet types for intranet access. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is an optional architecture diagram of the intranet access system 100 provided in an embodiment of the present application;

[0043] Figure 2 It is a schematic diagram of the structure of the server provided in the embodiment of the present application;

[0044] Figure 3 is a schematic diagram of the structure of a terminal provided in an embodiment of the present application;

[0045] Figure 4 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 1 ;

[0046] Figure 5 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 2 ;

[0047] Figure 6 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 3 ;

[0048] Figure 7 is a schematic diagram of decapsulating an encapsulated data packet provided in an embodiment of the present application;

[0049] Figure 8 This is a schematic diagram of the flow direction of the intranet access traffic provided by the embodiment of the present application Figure 1 ;

[0050] Fig. 9 This is a schematic diagram of the flow direction of the intranet access traffic provided by the embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0052] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0053] In the following description, the terms "first\second" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0054] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0055] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0056] 1) Cloud Technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data computing, storage, processing and sharing.

[0057] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which can be used on demand and is flexible and convenient. Cloud computing technology will become an important support. The backend services of the technical network system require a large amount of computing and storage resources, such as video networks, image websites and more portals. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the backend system for logical processing. Data of different levels will be processed separately. All kinds of industry data require strong system backing support, which can only be achieved through cloud computing.

[0058] 2) Intranet refers to the office network, that is, the local area network configured within the company. In order to protect internal information from being leaked, some companies will configure a local area network to connect various devices within the company so that internal devices can communicate and share resources, while devices outside the company cannot access internal resources.

[0059] 3) Extranet can be understood as the Internet. Any device that can access the extranet can access the extranet at any time, so the extranet has a wider coverage than the intranet. With this feature, company employees can access the company's intranet through the extranet anytime and anywhere, thus realizing remote work.

[0060] 4) Proxy service, which is responsible for forwarding network information between personal networks and the Internet, and controls and registers the forwarding. It is a bridge between personal networks and the Internet.

[0061] 5) Full-flow proxy means that all traffic is intercepted and proxied uniformly, that is, all data packets need to be sent through the same proxy.

[0062] 6) Traffic interception, that is, intercepting data packets, which can be data packets that the terminal wants to receive or data packets that the terminal wants to send.

[0063] 7) A Virtual Private Network (VPN) is a mechanism that simulates a private network on a public network. It means establishing a private network on a public network for encrypted communications, including implementing encryption and authentication to connect to the network and access remote systems. VPN is more secure than a proxy.

[0064] Full-size office means that you can work at your workplace or at a non-workplace, for example, you can work through the network at your residence or outdoors. The premise of full-size office is that users can successfully access the intranet through the extranet to interact with the intranet resources.

[0065] Mobile terminals are easy to carry, and more and more users choose to use mobile terminals for office work. However, compared with PC terminals, the computing resources and storage memory of mobile terminals are relatively low. Therefore, due to the limitations of computing resources and storage memory, the full-flow proxy mode of mobile terminals cannot directly manage all traffic. Instead, it will judge whether the mobile terminal is in the intranet or the extranet. When the mobile terminal is in the intranet, it will directly connect to access resources. When the mobile terminal is in the extranet, it will use the pre-configured VPN proxy to access resources. In addition, when using the VPN proxy, the type of data packet will be judged. When the data packet is of the Transmission Control Protocol (TCP) type or the User Datagram Protocol (UDP) type, it will be transmitted according to the TCP protocol or the UDP protocol respectively.

[0066] It can be seen that in the related art, when a user needs to access the intranet with the help of a mobile terminal, a VPN agent needs to be configured when accessing for the first time, and the configuration process of the VPN agent is quite complicated and cumbersome, which makes the convenience of intranet access low. In addition, when accessing the intranet through a VPN agent, only TCP or UDP data packets can be accepted, and the transmission of (Internet Protocol, IP) data packets is not supported, so that the VPN agent cannot intercept all traffic, and the types of data packets that can be used for content access are relatively small.

[0067] The embodiments of the present application provide an intranet access method, apparatus, device and computer-readable storage medium, which can improve the convenience of intranet access and expand the range of data packet types for intranet access. The following describes an exemplary application of the intranet access device provided by the embodiments of the present application. The intranet access device provided by the embodiments of the present application can be implemented as various types of user terminals such as laptop computers, tablet computers, desktop computers, set-top boxes, mobile devices (for example, mobile phones, portable music players, personal digital assistants, dedicated messaging devices, portable gaming devices), and can also be implemented as servers. When the intranet access device is used to receive encapsulated data packets and unpack the encapsulated data packets to obtain application data packets, the intranet access device can be implemented as a server; when the intranet access device is used to intercept the encapsulated data packets corresponding to the intranet access request and send the encapsulated data packets to the server, the intranet access device can be implemented as a terminal. Below, an exemplary application of the intranet access device will be described.

[0068] See also Figure 1 , Figure 1It is an optional architectural diagram of the intranet access system 100 provided in an embodiment of the present application. To support an intranet access application, the terminal 400 (terminal 400-1 and terminal 400-2 are shown as examples) is connected to the server 200 via the network 300. The network 300 can be a wide area network or a local area network, or a combination of the two.

[0069] The terminal 400 (an implementation of the intranet access device) is used to intercept the application data packet through the virtual network card device when detecting the application data packet containing the intranet access request and identity information of the application, and encapsulate the application data packet through the virtual network card device to obtain an encapsulated data packet. Then, the terminal 400 will send the encapsulated data packet to the server 200 through the communication interface plug-in. Among them, the terminal 400 receives the user's operation on the application in the interface of the application displayed by the graphical interface (graphical interface 400-11 and graphical interface 400-21 are shown as examples), and the operation includes the operation of triggering the application to generate an intranet access request.

[0070] The server 200 (another implementation of the intranet access device) is used to receive the encapsulated data packets sent by the terminal 400 through the virtual traffic proxy device, and the encapsulated data packets are obtained by encapsulating the application data packets intercepted by the terminal through the virtual network card device. The server 200 transmits the encapsulated data packets to the intranet service device in a channel according to the protocol type corresponding to the encapsulated data packets. Then, the server 200 decapsulates the encapsulated data packets through the intranet service device module, obtains the application data packets, and extracts the identity information from the application data packets. When the identity information authentication is passed, the server 200 responds to the intranet access request in the application data packet through the intranet service device to establish an intranet access connection with the terminal 400.

[0071] In some embodiments, the server 200 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal 400 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal and the server may be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiments of the present invention.

[0072] See also Figure 2 , Figure 2 is a schematic diagram of the structure of the server provided in the embodiment of the present application, Figure 2The server 200 shown includes: at least one first processor 210, a first memory 250, at least one first network interface 220 and a first user interface 230. The various components in the server 200 are coupled together via a first bus system 240. It is understood that the first bus system 240 is used to achieve connection and communication between these components. In addition to the data bus, the first bus system 240 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the first bus system 240 is not used in the example of FIG. Figure 2 In the figure, various buses are labeled as a first bus system 240 .

[0073] The first processor 210 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0074] The first user interface 230 includes one or more first output devices 231 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The first user interface 230 also includes one or more first input devices 232, including user interface components that facilitate user input, such as a keyboard, a mouse, a microphone, a touch screen display, a camera, other input buttons and controls.

[0075] The first memory 250 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. The first memory 250 may optionally include one or more storage devices physically located away from the first processor 210.

[0076] The first memory 250 includes a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The first memory 250 described in the embodiment of the present application is intended to include any suitable type of memory.

[0077] In some embodiments, the first memory 250 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0078] The first operating system 251 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;

[0079] A first network communication module 252, used to reach other computing devices via one or more (wired or wireless) first network interfaces 220, exemplary first network interfaces 220 include: Bluetooth, Wireless Fidelity (Wi-Fi), and Universal Serial Bus (USB), etc.;

[0080] A first presentation module 253 for enabling presentation of information (e.g., a user interface for operating peripherals and displaying content and information) via one or more first output devices 231 (e.g., a display screen, a speaker, etc.) associated with the first user interface 230;

[0081] The first input processing module 254 is configured to detect one or more user inputs or interactions from one of the one or more first input devices 232 and to translate the detected inputs or interactions.

[0082] In some embodiments, the intranet access device 255 provided in the embodiments of the present application may be implemented in software. Figure 2 The intranet access device 255 stored in the first memory 250 is shown, which can be software in the form of a program and a plug-in, etc., including the following software modules: a data receiving module 2551, a data transmission module 2552, a data decapsulation module 2553 and a connection establishment module 2554. These modules are logical, so they can be arbitrarily combined or further split according to the functions implemented. The functions of each module will be described below.

[0083] In other embodiments, the intranet access device 255 provided in the embodiment of the present application can be implemented in hardware. As an example, the intranet access device 255 provided in the embodiment of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the intranet access method provided in the embodiment of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs) or other electronic components.

[0084] Exemplarily, an embodiment of the present application provides a server, including:

[0085] A first memory, used to store executable intranet access instructions;

[0086] The first processor is used to implement the intranet access method provided by the server side of the embodiment of the present application when executing the executable intranet access instruction stored in the first memory.

[0087] See also Figure 3 , Figure 3 is a schematic diagram of the structure of a terminal provided in an embodiment of the present application, Figure 3 The terminal 400 shown includes: at least one second processor 410, a second memory 450, at least one second network interface 420 and a second user interface 430. The various components in the terminal 400 are coupled together via a second bus system 440. It is understood that the second bus system 440 is used to achieve connection and communication between these components. In addition to the data bus, the second bus system 440 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the second bus system 440 is not described in detail. Figure 3 In the figure, various buses are labeled as a second bus system 440 .

[0088] The second processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0089] The second user interface 430 includes one or more second output devices 431 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The second user interface 430 also includes one or more second input devices 432, including user interface components that facilitate user input, such as a keyboard, a mouse, a microphone, a touch screen display, a camera, other input buttons and controls.

[0090] The second memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. The second memory 450 may optionally include one or more storage devices physically located away from the second processor 410.

[0091] The second memory 450 includes a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The second memory 450 described in the embodiment of the present application is intended to include any suitable type of memory.

[0092] In some embodiments, the second memory 450 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0093] The second operating system 451 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;

[0094] A second network communication module 452, for reaching other computing devices via one or more (wired or wireless) second network interfaces 420, exemplary second network interfaces 420 include: Bluetooth, Wireless Fidelity (Wi-Fi), and Universal Serial Bus (USB), etc.;

[0095] A second presentation module 453 for enabling presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more second output devices 431 (e.g., a display screen, a speaker, etc.) associated with the second user interface 430;

[0096] The second input processing module 454 is used to detect one or more user inputs or interactions from one of the one or more second input devices 432 and translate the detected inputs or interactions.

[0097] In some embodiments, the intranet access device 455 provided in the embodiments of the present application may be implemented in software. Figure 3 An intranet access device 455 stored in the second memory 450 is shown, which can be software in the form of programs and plug-ins, including the following software modules: a data interception module 4551, a data encapsulation module 4552 and a data sending module 4553. These modules are logical and can therefore be arbitrarily combined or further split according to the functions implemented.

[0098] The functions of each module will be described below.

[0099] In other embodiments, the intranet access device 455 provided in the embodiment of the present application can be implemented in hardware. As an example, the intranet access device 455 provided in the embodiment of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the intranet access method provided in the embodiment of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs) or other electronic components.

[0100] Exemplarily, an embodiment of the present application provides a terminal, including:

[0101] A second memory, used for storing executable intranet access instructions;

[0102] The second processor is used to implement the intranet access method provided by the terminal side of the embodiment of the present application when executing the executable intranet access instruction stored in the second memory.

[0103] Below, the intranet access method provided in the embodiment of the present application will be explained in combination with the exemplary application and implementation of the terminal and server provided in the embodiment of the present application.

[0104] See also Figure 4 , Figure 4 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 1 , will combine Figure 4 The steps shown are explained.

[0105] S101. When a terminal detects an application data packet containing an intranet access request and identity information of an application program, the application data packet is intercepted by a virtual network card device.

[0106] The embodiment of the present application is implemented in a scenario where a user uses a terminal to access an intranet through an external network, for example, when a user accesses a company intranet through a network at his or her place of residence, or when a user accesses a company intranet through a mobile network. An application is installed in the terminal, which provides a functional interface for users to access the intranet. While generating an intranet access request, the application also generates identity information in order to indicate its own identity, and packages the intranet access request and identity information into an application data packet. When the terminal detects the application data packet, it will confirm that the user has a need to access the intranet, and will use a virtual network card device to intercept the application data packet, so as to obtain traffic at the application layer and perform full traffic proxy on the application layer traffic.

[0107] It is understandable that the virtual network card device is equivalent to the virtual proxy device of the terminal, providing proxy services for the terminal. In this application, the virtual network card device can be a TUN virtual device, a TAP virtual device, or other virtual devices, which are not specifically limited in this application.

[0108] In some embodiments, when a terminal intercepts an application data packet through a virtual network card device, it can be achieved by changing the transmission route when the terminal transmits the application data packet to a lower layer according to the five-layer model of Transmission Control Protocol / InternetProtocol (TCP / IP) or the seven-layer model of Open System Interconnect (OSI). For example, the route of the driver device is changed to the route of the virtual network card device, so that the application data packet will be transmitted to the virtual network card device to achieve interception.

[0109] It should be noted that the virtual network card device provides the terminal with computing resources and memory consumption resources in the full-flow proxy mode, so that the terminal has the computing power and storage capacity for the full-flow proxy mode.

[0110] It is understandable that the identity information can be a user ID, a user's work number, name, etc., or other identification information that can distinguish the user from other people. The intranet access request is used to indicate to the server that the user needs to access the intranet. The intranet access request can be a field, identifier, etc. agreed with the server, and this application does not limit it here.

[0111] S102: The terminal encapsulates the application data packet through the virtual network card device to obtain an encapsulated data packet.

[0112] After the terminal obtains the application data packet through the virtual network card device after intercepting it, it will add the header information required for transmission to the application data packet, and use the data packet after the header information is added as the encapsulated data packet.

[0113] In the embodiment of the present application, the process of encapsulating the application data packet by the terminal is essentially the process of adding a protocol header to the application data packet. Since the application data packet is in the application layer, the terminal will transmit the application data packet to the lower layer in the order of the TCP / IP five-layer model or the OSI seven-layer model, thereby adding the protocol headers required for transmission to the application data packet in turn, until it is transmitted to the bottom layer and the bottom layer protocol header is added, and then an encapsulated data packet is obtained.

[0114] In some embodiments, when transmitting an application data packet to a lower layer, the terminal may, in addition to adding a corresponding protocol header to the application data packet, also add a corresponding protocol tail to the application data packet, thereby obtaining an encapsulated data packet.

[0115] It is understandable that when the terminal encapsulates the application data packet, it actually encapsulates the data from the user state to the kernel state. Among them, the user state can only access the memory in a limited manner, and is not allowed to access peripheral devices, and the ability to occupy the CPU is deprived; in the kernel state, the CPU can access all the data in the memory, including peripheral devices such as hard disks and network cards.

[0116] S103: The server receives the encapsulated data packet sent by the terminal through the virtual traffic proxy device.

[0117] After the terminal obtains the encapsulated data packet through the virtual network card device, it will call the communication interface plug-in, and use the read and write interaction between the communication interface plug-in and the virtual network card device to obtain the encapsulated data packet. Then the terminal sends the encapsulated data packet to the server through the communication interface plug-in, so that the server determines the transmission method of the encapsulated data packet according to the protocol type corresponding to the encapsulated data packet, and transmits the encapsulated data packet to the intranet service device according to the transmission method. The encapsulated data packet is decapsulated by the intranet service device to obtain an application data packet, and identity information is extracted from the application data packet. When the identity information authentication is passed, the server responds to the intranet access request in the application data packet and establishes an intranet access connection.

[0118] It is understandable that the communication interface plug-in called by the terminal is implemented by different platforms, that is, the communication interface plug-in called is different for different terminal operating systems. When the operating system of the terminal is the Android system, the VPN service (VPNService) is called, and at this time, the encapsulated data packet obtained by the terminal through the VPN service is the encapsulated IP packet; when the operating system of the terminal is the iOS system, the network communication interface (Network Extension) is called, and at this time, the encapsulated data packet obtained by the terminal through the data acquisition support component (AppProxy Provider) in the Network Extension is the encapsulated TCP / UDP packet. That is to say, in the embodiment of the present application, there may be encapsulated data packets of multiple different protocol types.

[0119] It should be noted that the virtual traffic proxy device can be a smart virtual private network proxy (Smart Virtual Private Network, SmartVPN) running in the server, or a TUN virtual device running in the server, or other virtual devices running in the server, and this application does not limit this.

[0120] S104: The server transmits the encapsulated data packet to the intranet service device in a channel based on the protocol type of the encapsulated data packet.

[0121] Since different protocol types correspond to different transmission methods, after receiving the encapsulated data packet imported by the terminal through the communication interface plug-in, the server will first confirm the protocol type corresponding to the encapsulated data packet, and then use the protocol type corresponding to the encapsulated data packet to confirm the transmission method in which the encapsulated data packet should be transmitted to the intranet service device, and import the encapsulated data packet into the intranet service device according to the transmission method. In this way, the server can process data packets of various protocol types, and then the server can intercept all types of data packets.

[0122] For example, when the protocol type corresponding to the encapsulated data packet is UDP protocol, that is, when the encapsulated data packet is a UDP data packet, since UDP is a protocol that can be sent without establishing a connection, the server will directly import the encapsulated data packet into the intranet service device. When the protocol type corresponding to the encapsulated data packet is TCP protocol, or other protocols that require a connection to be transmitted, the transmission of the encapsulated data packet requires the participation of a proxy gateway, and the server will forward the encapsulated data packet to the intranet service device through the proxy gateway.

[0123] It should be noted that in the embodiment of the present application, by determining the corresponding transmission mode according to the protocol type of the encapsulated data packet, the process of channel-by-channel processing of encapsulated data packets of different protocol types is essentially realized, and the transmission mode corresponding to the encapsulated data packet is actually the processing channel corresponding to the encapsulated data packet.

[0124] It is understandable that the intranet service device is a module that provides computing, management, storage and other functions for the intranet, and both the intranet service device and the virtual traffic proxy device run on the server. In some embodiments, the server in the embodiment of the present application can be a server cluster. In this case, the intranet service device and the virtual traffic proxy device can run on different servers in the same server cluster. In this case, the intranet service device can be understood as an intranet server.

[0125] S105. The server decapsulates the encapsulated data packet through the intranet service device to obtain an application data packet, and extracts identity information from the application data packet.

[0126] The server decapsulates the encapsulated data packet through the intranet service device. Decapsulation is the reverse process of encapsulation, that is, the encapsulated data packet is transmitted to the upper layer in the order of the TCP / IP five-layer model or the OSI seven-layer model. The protocol header in the encapsulated data packet is removed at each layer until it reaches the application layer, and an application data packet without a protocol header is obtained. After that, the server will continue to read the data in the application data packet through the intranet service device, and extract the identity information used to represent the user identity, so as to facilitate subsequent identity authentication.

[0127] In some embodiments of the present application, when the terminal encapsulates the application data packet, it will also add a protocol tail or other information to the application data packet. At this time, when the server decapsulates the encapsulated data packet through the intranet service device, it will also remove the protocol tail or other information of the encapsulated data packet layer by layer.

[0128] S106. When the identity information authentication is passed, the server responds to the intranet access request in the application data packet through the intranet service device and establishes an intranet access connection with the terminal.

[0129] After extracting the identity information, the server will start to authenticate the identity information to determine whether the user corresponding to the identity information is a legitimate user in the intranet. When the identity information authentication is successful, that is, the user corresponding to the identity information is a legitimate user in the intranet, the server will respond to the intranet access request through the intranet service device and establish an intranet access connection with the terminal so that the user can access the resources in the intranet through the terminal. When the identity information authentication fails, that is, the user corresponding to the identity information is not a legitimate user in the intranet, the server will reject the intranet access request in the application data packet through the intranet service device, so that illegal users can be prevented from accessing the resources in the intranet.

[0130] In an embodiment of the present application, the server receives encapsulated data packets sent by the terminal through a virtual traffic proxy device. Since the encapsulated data packets are obtained by encapsulating application data packets intercepted by the terminal through a virtual network card device, full traffic proxy for application data packets is implemented, so that users can access the intranet without any configuration, reducing the configuration preparation during intranet access and greatly improving the convenience of intranet access; and determining the corresponding transmission mode based on the protocol type of the encapsulated data packet, thereby implementing channel-based processing for encapsulated data packets of different protocol types, so that different types of traffic can successfully access the intranet, expanding the range of data packet types for intranet access.

[0131] In some embodiments of the present application, the server transmits the encapsulated data packet to the intranet service device in a channel based on the protocol type corresponding to the encapsulated data packet, that is, the specific implementation process of S104 may include: S1041 or S1042, as follows:

[0132] S1041. When the protocol type corresponding to the encapsulated data packet is a connectionless protocol, the server directly sends the encapsulated data packet to the intranet service device to transmit the encapsulated data packet to the intranet service device in different channels.

[0133] The server determines whether the protocol type corresponding to the encapsulated data packet is a connectionless protocol or a connection-oriented protocol, thereby determining whether the encapsulated data packet needs to be directly forwarded or proxy forwarded. When the server determines that the protocol type corresponding to the encapsulated data packet is a connectionless protocol, the server will determine the transmission mode of the encapsulated data packet as direct forwarding, that is, directly sending the encapsulated data packet to the intranet service device without establishing a connection between the virtual traffic proxy device and the intranet service device.

[0134] It is understood that a connectionless protocol means that the two communicating parties do not need to connect a communication line in advance, but directly send the data packet carrying the destination address to the line, and the system independently selects an optional route for transmission. The connectionless protocol may include the UDP protocol, and may also include the Sequenced Packet Exchange Protocol (SPX), etc., which is not limited in this application.

[0135] S1042: When the protocol type corresponding to the encapsulated data packet belongs to a connection-oriented protocol, the server sends the encapsulated data packet to the intranet service device through the gateway, so as to transmit the encapsulated data packet to the intranet service device in different channels.

[0136] When the server determines that the protocol type corresponding to the encapsulated data packet is a connection-oriented protocol, the server will determine the transmission mode of the encapsulated data packet as proxy forwarding, that is, establish a connection between the virtual traffic proxy device and the gateway, and then forward the encapsulated data packet to the intranet service device through the gateway.

[0137] It is understandable that the connection-oriented protocol means that before the two communicating parties transmit data, they need to comply with specific rules to establish a logical connection. The connection-oriented protocol may include TCP protocol, X25 protocol, etc., which are not limited in this application.

[0138] In an embodiment of the present application, the server can determine the protocol type corresponding to the encapsulated data packet. When it is determined that the protocol type corresponding to the encapsulated data packet belongs to a connectionless protocol, the transmission mode is determined to be direct forwarding. When it is determined that the protocol type corresponding to the encapsulated data packet belongs to a connection-oriented protocol, the transmission mode is determined to be proxy forwarding. This can achieve the effect of processing different protocol types according to different processing methods, so that encapsulated data packets of various protocol types can be processed.

[0139] See also Figure 5 , Figure 5 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 2 In some embodiments of the present application, the server transmits the encapsulated data packet to the intranet service device in a channel based on the protocol type corresponding to the encapsulated data packet, that is, the specific implementation process of S104 may also include: S1043-S1044, as follows:

[0140] S1043: When the protocol type corresponding to the encapsulated data packet belongs to other protocol types except the connectionless protocol and the connection-oriented protocol, the server performs protocol conversion on the encapsulated data packet to obtain a converted data packet.

[0141] When the server determines that the protocol type corresponding to the encapsulated data packet is neither a connectionless protocol nor other protocol types of a connection-oriented protocol, in order to be able to normally process the encapsulated data packets of other protocol types, the server will call the network protocol stack through the virtual traffic proxy device, and use the network protocol stack to convert the encapsulated data packets belonging to other protocol types, thereby obtaining the converted data packets.

[0142] It should be noted that the protocol type corresponding to the converted data packet is any one of the connectionless protocol and the connection-oriented protocol. That is to say, using the network protocol stack (Netstack) to convert other protocol types is essentially to convert the encapsulated data packets of other protocol types into data packets of connectionless protocol or connection-oriented protocol, so as to facilitate the subsequent selection of the transmission mode corresponding to the encapsulated data packet from direct forwarding or proxy forwarding.

[0143] Furthermore, connectionless protocols include User Datagram Protocol, connection-oriented protocols include Transmission Control Protocol, and other protocol types include Internet Protocol. Thus, the network protocol stack is used to convert encapsulated data packets of other protocol types into data packets of connectionless protocols or connection-oriented protocols, and encapsulated data packets of IP protocol can be converted into TCP data packets or UDP data packets.

[0144] S1044. The server determines the matching transmission mode corresponding to the converted data packet based on the protocol type corresponding to the converted data packet, and sends the converted data packet to the intranet service device based on the matching transmission mode, so as to transmit the encapsulated data packet to the intranet service device in different channels.

[0145] The server determines the protocol type corresponding to the converted data packet. When it is determined that the protocol type corresponding to the converted data packet is a connectionless protocol, direct forwarding will be used as the matching transmission mode corresponding to the encapsulated data packet, thereby directly sending the converted data packet to the intranet service device; when it is determined that the protocol type corresponding to the converted data packet is a connection-oriented protocol, the matching transmission mode of the converted data packet will be determined as proxy forwarding, that is, a connection between the virtual traffic proxy device and the gateway will be established, and the converted data packet will be forwarded to the intranet service device through the gateway.

[0146] In some embodiments, when the converted data packet is transmitted using the matching transmission mode, the converted data packet may be first forwarded to an endpoint (Endpoint), and then forwarded to the intranet service device through the endpoint.

[0147] In an embodiment of the present application, when the protocol type corresponding to the encapsulated data packet is other protocol types, the server can perform protocol conversion on the encapsulated data packet, and then select a corresponding matching transmission method for the encapsulated data packet based on the protocol type corresponding to the converted data packet, thereby achieving that various types of data packets can be transmitted to the intranet service device.

[0148] See also Figure 6 , Figure 6 This is an optional process diagram of the intranet access method provided in the embodiment of the present application. Figure 3 In some embodiments of the present application, before the server forwards the encapsulated data packet to the intranet service device through the gateway, that is, before S1042, the method may include: S1045, as follows:

[0149] S1045. The server performs a three-way handshake between the virtual traffic proxy device and the gateway, and establishes a local connection between the virtual traffic proxy device and the gateway when the handshake is successful.

[0150] When the server forwards the encapsulated data packet to the intranet service device through the gateway, it first needs to let the virtual traffic proxy device perform a three-way handshake with the gateway, and after the handshake is completed, a reliable local connection is established to enable the gateway to proxy the encapsulated data packet.

[0151] It is understandable that the main purpose of the three-way handshake is to ensure that the direct connection between the virtual traffic proxy device and the gateway is duplex. The first handshake is when the connection is established. The virtual traffic proxy device sends a Synchronize Sequence Numbers (SYN) packet to the gateway and waits for the gateway to confirm. In the second handshake, the gateway receives the SYN packet, confirms the SYN packet of the virtual traffic proxy device, and sends a SYN+ACK (Acknowledge character) packet at the same time. In the third handshake, the virtual traffic proxy receives the SYN+ACK packet and sends an acknowledgment packet to the gateway. After the acknowledgment packet is sent, the gateway enters the ESTABLTSHED state, completing the three-way handshake.

[0152] When the virtual traffic proxy device and the gateway handshake successfully, in the embodiment of the present application, the server forwards the encapsulated data packet to the intranet service device through the gateway, that is, the implementation process of S1042 will include S1042a-S1042b, as follows:

[0153] S1042a. The server transmits the encapsulated data packet to the gateway via the local connection.

[0154] After the server establishes a local connection through a three-way handshake, it sends the encapsulated data packet to the gateway through the local connection. The gateway receives the encapsulated data packet to implement Internet access proxy for the encapsulated data packet.

[0155] S1042b. The server forwards the encapsulated data packet to the intranet service device through the gateway.

[0156] After receiving the encapsulated data packet, the gateway will attach the route of the intranet service device to the encapsulated data packet. After the server system determines the route, it will know that the encapsulated data packet is to be sent to the intranet service device, thereby forwarding the encapsulated data packet to the intranet service device.

[0157] In an embodiment of the present application, the server establishes a direct local connection between the virtual traffic proxy device and the gateway through a three-way handshake, and then sends the encapsulated data packet to the gateway through the local connection, and then forwards the encapsulated data packet to the intranet service device through the gateway. In this way, the server can realize the process of forwarding the encapsulated data packet to the intranet service device through the gateway.

[0158] In some embodiments of the present application, the server decapsulates the encapsulated data packet through the intranet service device to obtain the application data packet, that is, the specific implementation process of S105 may include: S1051-S1052, as follows:

[0159] S1051. The server removes each protocol header in the encapsulated data packet layer by layer through the intranet service device until a data body without the protocol header is obtained.

[0160] S1052: The server takes the data body not including the protocol header as an application data packet.

[0161] Since the encapsulated data packet is an application data packet with a protocol header added when it is transmitted to the lower layer, the encapsulated data packet includes various protocol headers and a data body that does not contain a protocol header, wherein each protocol header represents additional information during transmission and specifies the destination path, source path, etc. for transmission. When the server decapsulates the encapsulated data packet through the intranet service device, it will first remove each protocol header in the encapsulated data packet one by one until the data body is obtained, and then the data body will be used as the application data packet.

[0162] Illustratively, the present application embodiment provides a schematic diagram of decapsulating an encapsulated data packet. Figure 7 The encapsulated data packet has a MAC (Media Access Control Address) header 7-1, an IP header 7-2, a TCP header 7-3, and a data body 7-4 in sequence. The server first removes the MAC header 7-1, then the IP header 7-2, and then the TCP header 7-3 through the intranet service device. The remaining data body 7-4 is the application data packet.

[0163] In an embodiment of the present application, the server first removes the various protocol headers in the encapsulated data packet through the intranet service device to obtain a data body that does not contain the protocol header, and then uses the data body as an application data packet. In this way, the server implements the unpacking process of the encapsulated data packet through the intranet service device, so as to facilitate the subsequent acquisition of identity information for identity authentication from the application data packet.

[0164] In some embodiments of the present application, the communication interface plug-in includes at least one interface plug-in corresponding to at least one operating system. At this time, the terminal sends the encapsulated data packet to the server through the communication interface plug-in, that is, the specific implementation process of S103 may include: S1031-S1032, as follows:

[0165] S1031. The terminal selects a target interface plug-in corresponding to the encapsulated data packet from at least one interface plug-in corresponding to at least one operating system according to the operating system.

[0166] Since different operating systems can be run on the terminal, and each operating system has its own corresponding interface plug-in, the terminal will select the interface plug-in corresponding to the encapsulated data packet from at least one interface plug-in according to its own operating system, and record the selected interface plug-in as the target interface plug-in.

[0167] It is understandable that at least one interface plug-in includes a network communication interface plug-in and a virtual private network proxy service plug-in, i.e., a VPN service plug-in. Among them, the VPN service plug-in is a plug-in corresponding to the Android system, and the network communication interface plug-in is a plug-in (Network Extension) corresponding to the iOS system. Therefore, when the terminal is an Android system, the terminal selects the VPN service plug-in from at least one interface plug-in as the target interface plug-in, and when the terminal is an iOS system, the terminal selects the network communication interface plug-in from at least one interface plug-in as the target interface plug-in.

[0168] S1032. The terminal uses the target interface plug-in corresponding to the encapsulated data packet to send the encapsulated data packet to the server.

[0169] After selecting the target interface plug-in corresponding to the encapsulated data packet, the terminal will send the encapsulated data packet to the server through the target interface plug-in, thus realizing the process of sending the encapsulated data packet to the server through the communication interface plug-in.

[0170] In an embodiment of the present application, the terminal can select a target interface plug-in that can be applied to its operating system from at least one interface plug-in corresponding to at least one operating system based on its own operating system, and then import the encapsulated data packet into the server through the target interface plug-in so that the server can obtain the encapsulated data packet.

[0171] The following is an explanation of an exemplary application of the embodiments of the present application in a practical application scenario.

[0172] The embodiment of the present application is implemented in the scenario where the user accesses the intranet while performing full-size office work. Figure 8 , Figure 8 This is a schematic diagram of the flow direction of the intranet access traffic provided by the embodiment of the present application Figure 1 , the mobile terminal (terminal) interacts with APP8-1 (application) through TUN virtual device 8-2 (virtual network card device) based on the concept of zero trust network, thereby intercepting the traffic (application data packet) of the user APP, and then using the mobile terminal native plug-in Extension (communication interface plug-in) to direct the traffic to SmartVPN traffic management module 8-5 (virtual traffic proxy device), where Extension is implemented by platform, and is implemented by Network Extension 8-3 (target interface plug-in) under iOS system (terminal operating system), at this time, the traffic is IP packet or TCP / UDP packet; under Android system (terminal operating system), it is implemented by VPNService8-4 (VPN service plug-in, i.e. target interface plug-in), at this time, the traffic is IP packet. SmartVPN traffic management module 8-5 is based on the protocol of the data packet, and chooses to connect the traffic directly to the intranet server 8-6 (intranet service device) or through the gateway 8-7 proxy, so as to forward it to the intranet server 8-6. In this way, full traffic proxy can be performed on the mobile terminal, breaking through the internal and external network resolution to support employees (users) to carry out full-scale office safely and effectively.

[0173] See also Fig. 9 , Fig. 9 This is a schematic diagram of the flow direction of the intranet access traffic provided by the embodiment of the present application Figure 2. When the mobile terminal intercepts the traffic 9-2 through the TUN virtual device 9-1, the traffic can be imported into the SmartVPN traffic management module 9-4 through the mobile terminal native plug-in Extension9-3. The SmartVPN9-4 traffic management module supports data packets of three different protocols: IP, TCP, and UDP, and can process these three data packets separately. Specifically, when the traffic is an IP data packet 9-5 (a data packet of other protocol types), SmartVPN9-4 can use Netstack, that is, the network protocol stack, to convert the IP data packet 9-5 into a TCP data packet 9-6 (the converted data packet) or a UDP data packet 9-7 (the converted data packet). When converted to a UDP data packet 9-7, it can be directly connected to the endpoint 9-8, and then directly connected to the intranet server 9-9 through the endpoint 9-8; when converted to a TCP data packet 9-6, it can shake hands with the endpoint 9-8 and connect to the intranet server 9-9 through the smart gateway 9-10 (gateway). When the traffic is a TCP data packet 9-11 (a connection-oriented protocol), it is necessary to simulate the three-way handshake between the target address and the source address locally, and forward the TCP data packet to the intranet server 9-9 through the smart gateway 9-10. When the traffic is a UDP data packet (a connectionless protocol), the SmartVPN traffic management module 9-4 can be directly connected to the intranet server 9-9, thereby directly sending the UDP data packet 9-12 to the intranet server 9-9.

[0174] Through the above method, the same interception of user-layer traffic can be achieved, and with the help of virtual TUN devices to support the problem of insufficient computing resources and memory resources on the mobile terminal, direct access to intranet resources and services can still be achieved without distinguishing between intranet and extranet environments when resources are limited. Different data packets can be processed in different channels, which increases the types of data packets that can be processed and effectively improves the convenience of accessing the intranet.

[0175] The following is a description of an exemplary structure of the intranet access device 255 provided in the embodiment of the present application as a software module. In some embodiments, Figure 2 As shown, the software modules stored in the intranet access device 255 of the first memory 250 may include:

[0176] The data receiving module 2551 is used to receive the encapsulated data packet sent by the terminal through the virtual traffic proxy device; the encapsulated data packet is obtained by encapsulating the application data packet intercepted by the terminal through the virtual network card device;

[0177] The data transmission module 2552 is used to transmit the encapsulated data packet to the intranet service device in different channels based on the protocol type corresponding to the encapsulated data packet;

[0178] The data decapsulation module 2553 is used to decapsulate the encapsulated data packet through the intranet service device to obtain an application data packet, and extract identity information from the application data packet;

[0179] The connection establishing module 2554 is used to establish an intranet access connection with the terminal by responding to the intranet access request in the application data packet through the intranet service device when the identity information authentication is passed.

[0180] In some embodiments of the present application, the data transmission module 2552 is also used to send the encapsulated data packet directly to the intranet service device when the protocol type corresponding to the encapsulated data packet is a connectionless protocol, so as to transmit the encapsulated data packet to the intranet service device in a channel; when the protocol type corresponding to the encapsulated data packet is a connection-oriented protocol, forward the encapsulated data packet to the intranet service device through a gateway, so as to transmit the encapsulated data packet to the intranet service device in a channel.

[0181] In some embodiments of the present application, the data transmission module 2552 is also used to perform protocol conversion on the encapsulated data packet to obtain a converted data packet when the protocol type corresponding to the encapsulated data packet belongs to other protocol types except the connectionless protocol and the connection-oriented protocol; wherein the protocol type corresponding to the converted data packet is any one of the connectionless protocol and the connection-oriented protocol, the connectionless protocol includes the User Datagram Protocol, the connection-oriented protocol includes the Transmission Control Protocol, and the other protocol types include the Internet Protocol; based on the protocol type corresponding to the converted data packet, determine the matching transmission mode corresponding to the converted data packet, and send the converted data packet to the intranet service device based on the matching transmission mode, so as to transmit the encapsulated data packet to the intranet service device in a channel.

[0182] In some embodiments of the present application, the data transmission module 2552 is further used to perform a three-way handshake between the virtual traffic proxy device and the gateway, and establish a local connection between the virtual traffic proxy device and the gateway when the handshake is successful;

[0183] The data transmission module 2552 is further configured to transmit the encapsulated data packet to the gateway via the local connection; and forward the encapsulated data packet to the intranet service device via the gateway.

[0184] In some embodiments of the present application, the data decapsulation module 2553 is also used to remove each protocol header in the encapsulated data packet layer by layer through the intranet service device until a data body that does not contain a protocol header is obtained; each protocol header represents additional information during transmission; and the data body that does not contain a protocol header is used as the application data packet.

[0185] The following is a description of an exemplary structure of the intranet access device 455 provided in the embodiment of the present application as a software module. In some embodiments, Figure 3 As shown, the software modules stored in the intranet access device 455 of the second memory 450 may include:

[0186] The data interception module 4551 is used to intercept the application data packet through the virtual network card device when an application data packet containing an intranet access request and identity information of an application is detected;

[0187] The data encapsulation module 4552 is used to encapsulate the application data packet through the virtual network card device to obtain an encapsulated data packet;

[0188] The data sending module 4553 is used to send the encapsulated data packet to the server through the communication interface plug-in, so that the server determines the transmission mode of the encapsulated data packet according to the protocol type corresponding to the encapsulated data packet, and transmits the encapsulated data packet to the intranet service device according to the transmission mode, decapsulates the encapsulated data packet through the intranet service device to obtain an application data packet, extracts identity information from the application data packet, and establishes an intranet access connection in response to the intranet access request in the application data packet when the identity information is authenticated.

[0189] In some embodiments of the present application, the communication interface plug-in includes at least one interface plug-in corresponding to at least one operating system;

[0190] The data sending module 4553 is also used to select a target interface plug-in corresponding to the encapsulated data packet from the at least one interface plug-in corresponding to the at least one operating system according to the operating system; and use the target interface plug-in corresponding to the encapsulated data packet to send the encapsulated data packet to the server.

[0191] The embodiment of the present application provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the intranet access method described in the embodiment of the present application.

[0192] An embodiment of the present application provides a computer-readable storage medium storing executable instructions, wherein executable intranet access instructions are stored. When the executable intranet access instructions are executed by a first processor, the first processor will be caused to execute the intranet access method provided by the server side of the embodiment of the present application. When the executable intranet access instructions are executed by a second processor, the second processor will be caused to execute the intranet access method provided by the terminal side of the embodiment of the present application.

[0193] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface storage, optical disk, or CD-ROM; or it may be various devices including one or any combination of the above memories.

[0194] In some embodiments, the executable intranet access instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0195] As an example, executable intranet-access instructions may, but do not necessarily, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, for example, in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions).

[0196] As an example, the executable intranet-accessible instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one site, or on multiple computing devices distributed at multiple sites and interconnected by a communication network.

[0197] The above is only an embodiment of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the present application are included in the protection scope of the present application.

Claims

1. An intranet access method, characterized in that: include: Receive the encapsulated data packet sent by the terminal through the virtual traffic proxy device; The encapsulated data packet is obtained by encapsulating the application data packet intercepted by the terminal through the virtual network card device from the application layer to the lower layer in sequence to the bottom layer; the content of the encapsulated data packet includes the protocol header corresponding to each layer, the application data packet, and the protocol tail corresponding to each layer; the application data packet includes the intranet access request and identity information; When the protocol type corresponding to the encapsulated data packet belongs to a connectionless protocol, the encapsulated data packet is directly sent to the intranet service device, so as to transmit the encapsulated data packet to the intranet service device in different channels; When the protocol type corresponding to the encapsulated data packet belongs to a connection-oriented protocol, the encapsulated data packet is forwarded to the intranet service device through a gateway, so as to transmit the encapsulated data packet to the intranet service device in a channel; Removing the protocol header corresponding to each layer and the protocol tail of each layer in the encapsulated data packet layer by layer through the intranet service device until a data body that does not include the protocol header corresponding to each layer and the protocol tail of each layer is obtained; Using the data body as the application data packet, and extracting the identity information from the application data packet; When the identity information authentication is passed, the intranet service device responds to the intranet access request in the application data packet to establish an intranet access connection with the terminal.

2. The method according to claim 1, characterized in that The method further comprises: When the protocol type corresponding to the encapsulated data packet belongs to other protocol types except the connectionless protocol and the connection-oriented protocol, performing protocol conversion on the encapsulated data packet to obtain a converted data packet; The protocol type corresponding to the converted data packet is any one of the connectionless protocol and the connection-oriented protocol, the connectionless protocol includes the User Datagram Protocol, the connection-oriented protocol includes the Transmission Control Protocol, and the other protocol types include the Internet Protocol; Based on the protocol type corresponding to the converted data packet, determine the matching transmission mode corresponding to the converted data packet, and send the converted data packet to the intranet service device according to the matching transmission mode, so as to transmit the encapsulated data packet to the intranet service device in different channels.

3. The method according to claim 1, characterized in that Before forwarding the encapsulated data packet to the intranet service device through the gateway, the method further includes: Performing a three-way handshake between the virtual traffic proxy device and the gateway, and establishing a local connection between the virtual traffic proxy device and the gateway when the handshake succeeds; The step of forwarding the encapsulated data packet to the intranet service device through the gateway includes: transmitting the encapsulated data packet to the gateway via the local connection; The encapsulated data packet is forwarded to the intranet service device through the gateway.

4. An intranet access method, characterized in that: include: When an application data packet containing an intranet access request and identity information of an application is detected, the application data packet is intercepted by a virtual network card device; The virtual network card device encapsulates the application data packet layer by layer when transmitting it sequentially from the application layer to the lower layer to the bottom layer, thereby obtaining an encapsulated data packet; the content of the encapsulated data packet includes a protocol header corresponding to each layer, the application data packet, and a protocol tail corresponding to each layer; The encapsulated data packet is sent to the server through the communication interface plug-in, so that the server determines the transmission mode of the encapsulated data packet according to the protocol type corresponding to the encapsulated data packet, and transmits the encapsulated data packet to the intranet service device according to the transmission mode, so that the protocol header corresponding to each layer and the protocol tail of each layer in the encapsulated data packet are removed layer by layer through the intranet service device until a data body that does not contain the protocol header corresponding to each layer and the protocol tail of each layer is obtained; Taking the data body as the application data packet, extracting identity information from the application data packet, and establishing an intranet access connection in response to an intranet access request in the application data packet when the identity information is authenticated; Among them, when the protocol type corresponding to the encapsulated data packet belongs to a connectionless protocol, the encapsulated data packet is directly sent to the intranet service device so that the encapsulated data packet is transmitted to the intranet service device in a channel; when the protocol type corresponding to the encapsulated data packet belongs to a connection-oriented protocol, the encapsulated data packet is forwarded to the intranet service device through a gateway so that the encapsulated data packet is transmitted to the intranet service device in a channel.

5. The method according to claim 4, characterized in that The communication interface plug-in includes: at least one interface plug-in corresponding to at least one operating system; the step of sending the encapsulated data packet to the server through the communication interface plug-in includes: According to the operating system, selecting a target interface plug-in corresponding to the encapsulated data packet from the at least one interface plug-in corresponding to the at least one operating system; The encapsulated data packet is sent to the server using the target interface plug-in corresponding to the encapsulated data packet.

6. An intranet access device, characterized in that: include: A data receiving module, used for receiving encapsulated data packets sent by a terminal through a virtual traffic proxy device; The encapsulated data packet is obtained by encapsulating the application data packet intercepted by the terminal through the virtual network card device from the application layer to the lower layer in sequence to the bottom layer; the content of the encapsulated data packet includes the protocol header corresponding to each layer, the application data packet, and the protocol tail corresponding to each layer; the application data packet includes the intranet access request and identity information; A data transmission module, for sending the encapsulated data packet directly to an intranet service device when the protocol type corresponding to the encapsulated data packet belongs to a connectionless protocol, so as to transmit the encapsulated data packet to the intranet service device in different channels; and for forwarding the encapsulated data packet to the intranet service device through a gateway when the protocol type corresponding to the encapsulated data packet belongs to a connection-oriented protocol, so as to transmit the encapsulated data packet to the intranet service device in different channels; A data decapsulation module, used to remove the protocol header corresponding to each layer and the protocol tail of each layer in the encapsulated data packet layer by layer through the intranet service device, until a data body that does not contain the protocol header corresponding to each layer and the protocol tail of each layer is obtained; Using the data body as the application data packet, and extracting the identity information from the application data packet; The connection establishment module is used to establish an intranet access connection with the terminal by responding to the intranet access request in the application data packet through the intranet service device when the identity information authentication is passed.

7. A server, characterized in that: include: A first memory, used to store executable intranet access instructions; The first processor is configured to implement the method according to any one of claims 1 to 3 when executing the executable intranet access instruction stored in the first memory.

8. A terminal, characterized in that: include: A second memory, used for storing executable intranet access instructions; The second processor is used to implement the method described in any one of claims 4 to 5 when executing the executable intranet access instruction stored in the second memory.

9. A computer-readable storage medium, characterized in that: An executable intranet access instruction is stored, which is used to implement the method described in any one of claims 1 to 3 when executed by a first processor; or is used to implement the method described in any one of claims 4 to 5 when executed by a second processor.

10. A computer program product comprising computer instructions, characterized in that The computer instructions are used to implement the method described in any one of claims 1 to 3 when executed by a first processor; or are used to implement the method described in any one of claims 4 to 5 when executed by a second processor.

Images